[389-users] 389 certificate issues...

[Chandrasekar Kannan]

On 10/02/2009 05:30 PM, Marc Sauton wrote:
> Trey Sheldon wrote:
>> Hello all,
>>
>> I've been evaluating and prepping to deploy 389 for a couple months 
>> now and while working on my final deployment I've run into a snag...
>>
>> I created two servers and successfully enabled SSL on them.  I'm 
>> attempting to create a third using the exact same procedure and can't 
>> seem to get SSL enabled.
>>
>> I used the admin-gui to install the request / install the certs and 
>> roots.
>>
>> ##WORKING
>> #certutil -L -d .
>> Certificate Nickname                                         Trust 
>> Attributes
>>                                                              
>> SSL,S/MIME,JAR/XPI
>> Metaweb Root Certificate                                     CT,,
>> Metaweb Host Root Certificate                                CT,,
>> server-cert                                                  u,u,u
>>
>> # certutil -L -d . -n server-cert
>> Certificate:
>>     Data:
>>         Version: 3 (0x2)
>>         Serial Number: 88 (0x58)
>>         Signature Algorithm: PKCS #1 MD5 With RSA Encryption
>>     Issuer: ........ <full certificate>
>>
>> ## NOT WORKING
>> # certutil -L -d .
>> Certificate Nickname                                         Trust 
>> Attributes
>>                                                              
>> SSL,S/MIME,JAR/XPI
>> Metaweb Root Certificate                                     CT,,
>> Metaweb Host Root Certificate                                CT,,
>> server-cert                                                  u,u,u
>>
>> # certutil -L -d . -n server-cert
>> certutil: Could not find: server-cert
>> : security library: bad database.
>>
> It means the nick-name provided to certutil does not exist in the NSS db.

certutil -X -d . (might help as it tries to open the db in write mode)...

> Aside cert8.db, key3.db, secmod.db files and directory permissions, 
> reading the 2 root certificates from this specific NSS db directory 
> for sanity check, is it possible the string "server-cert" that you 
> expect for the nickname was stored with some extra spaces appended to 
> it?...
> Is the cert visible in the console?
> Any specific errors in the console when you try to install the cert or 
> enable SSL?
>>
>> These systems are automatically deployed and configured and should 
>> have identical package revisions and configurations.  I'm at a blank 
>> to what is causing the problem.   Any insight that people have would 
>> be *greatly* appreciated.
>>
>> Sincerely,
>> Trey SHeldon
>>
>> -- 
>> 389 users mailing list
>> 389-users at redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
> -- 
> 389 users mailing list
> 389-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users